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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after srx (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 
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1 )□ Responsive to communication(s) filed on . 

2a)n This action is FINAL. 2b)KI This action is non-final. 

3) D Since this application is in condition for allowance except for foimal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 21 3. 
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4) n Claim(s) 1-19 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) n Glaim(s) 1-19 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) n Claim{s) are subject to restriction and/or election requirement. 

Appiication Papers 

9) 0 The specification is objected to by the Examiner. 

10) 0 The drawing(s) filed on is/are: a)[3 accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) 0 The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 
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1 •□ Certified copies of the priority documents have been received. 
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3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attachment(s) 

1) ^ Notice of References Cited (PTO-892) 4) □ Interview Sumnnary (PTO-413) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) □ Information Disclosure Statement(s) (PTO/SB/08) 5) □ Notice of Infonnal Patent Application 

Paper No(s)/Mail Date . 6) □ Other: . 



U.S. Patent and Trademark Office 
PTOL-326 (Rev. 08-06) 



Office Action Summary 



Part of Paper No./Mail Date 20071001 



Application/Control Number: 10/780,252 Page 2 

Art Unit: 2134 

DETAILED ACTION 

CLAIMS PRESENTED 

Claims 1-48 are presented. 

Potentially Allowable Subject Matter 

The following is a statement of reasons for the indication of allowable subject 
matter: Claims 1-24 potentially allowable over prior art. The prototypical model is 
developed from such particular details of packet capturing, packet analysis, and mining 
of the packet database. An important feature is that the prototypical model uses time as 
a factor. The way the claimed invention uses the time factor causes the prototypical 
model to handle changing content. In the methodology of the prior art, the time factor 
was not used in the same way as in the claimed invention. Indeed, the methodology of 
the prior art would have trouble with a changing content because of the reliance on 
historical data with an assumption of more stability in content. 

Claims 25-48 does not contain subject matter that can overcome prior art. Some 
of the claims recite packet analysis. This alone is not sufficient because the prior art (as 
admitted by Applicant) does acquire data from packets. Some of the claims recite real- 
time functioning. This alone is not sufficient because the prior art does some (albeit not 
all of the functions as in claim 1) functions in real-time. Some of the claims recite 
Changing content. This alone is not sufficient because the prior art does account for 
changing content (albeit not with the particular fashion as detailed with the recited 
features of claim 1). See the rejections of claims 25-48 for further details. 
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CLAIM REJECTIONS 

Claim Rejections • 35 use § 101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Regarding claims 1-48, the claimed invention is directed to non-statutory subject 
matter. Claims recite only perfunctory recitation of functional material (packets, content, 
networks, data, computer readable medium, etc.)- Aside from this, the claims recite 
only nonfunctional descriptive material. When nonfunctional descriptive material is 
recorded on some computer-readable medium, in a computer or on an electromagnetic 
carrier signal, it is not statutory since no requisite functionality is present to satisfy the 
practical application requirement. Merely claiming nonfunctional descriptive material, 
i.e., abstract ideas, stored on a computer-readable medium, in a computer, or on an 
electromagnetic carrier signal, does not make it statutory. See Diehr, 450 U.S. at 185- 
86, 209 USPQ at 8 (noting that the claims for an algorithm in Benson were unpatentable 
as abstract Ideas because "[t]he sole practical application of the algorithm was In 
connection with the programming of a general purpose computer."). Such a result would 
exalt form over substance. 

For further guidance on the term "nonfunctional", please see MPEP 2106. 
Ciaim Rejections - 35 USC § 102 
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The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(a) the invention was known or used by others in this country, or patented or described in a printed 
publication in this or a foreign country, before the invention thereof by the applicant for a patent. 

Claims 25-48 are rejected under 35 U.S.C. 102(a) as being clearly anticipated by 
admissions over the prior art. 

The prior art, as discussed in the specification (and not merely discussed in the 
first few pages), refer to the previous types of analysis of anomalies. These anomalies, 
as noted by Applicant, already had packet analysis, real-time functioning, and changing 
content. Indeed, as Applicant noted, there is an entire body of knowledge regarding 
these matters. See, for instance, the entire bibliography o f books and articles that 
Applicant has cited in the specification. 

Some of the claims (claims 25-48 generally) recite packet analysis. This alone Is 
not sufficient because the prior art (as admitted by Applicant) does acquire data from 
packets. See page 6 of the specification. Some of the claims (claims 25-28) recite real- 
time functioning. This alone is not sufficient because the prior art does some (albeit not 
all of the functions as in claim 1) functions in real-time. See, for instance, the discussion 
regarding intrusion detection, such as from Escamilla, Lippman, LaPadula, etc. that are 
noted in the specification. Intrusion detection work in real-time. Some of the claims 
(claims 29-35, 41-48 which recite trends, claims 36-40 which recite historical data) 
recite changing content. This alone is not sufficient because the prior art does account 
for changing content (albeit not with the particular fashion as detailed with the recited 
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features of claim 1). See, for instance, the anomaly detection of Javitz, Jou, Lane, 
Fukanaga, Rabiner, etc. that are discussed in the specification. 

Conclusion 

The art made of record and not relied upon is considered pertinent to applicant's 
disclosure. The art disclosed general background. 

Points of Contact 

Any response to this action sliould be mailed to: 

Commissioner of Patents and Trademarks 
Washington, D.C. 20231 

or faxed to: 

(571) 273-8300, (for formal communications intended for entry) 
Or: 

(571) 273-3836 (for informal or draft communications, please label "PROPOSED" or 
"DRAFT') 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to David Jung whose telephone number is (571) 272-3836 
or Kambiz Zand whose telephone number is (272) 272-381 1 . 



David Jung 




Patent Examiner 
10/1/07 



